Correlation sources in Search filter Role Access restriction

[sujith_kumar]

Hi All,

We have an index indexA, which gets data from multiple agencies agentA, agentB, agentC, and another index indexB, which has only agentB data.

Our requirement is to correlate between indexA and indexB to restrict the users to have access only to agentB data from both the indexes indexA and indexB.

I tried below options:

a. search filter using lookup  as below, 

index=indexA  | search [ | inputlookup indexB_lookup.csv | fields indexB_agentB | rename indexB_agentB as indexA_agentB]

b. coreleation search as below,

(index=indexA  sourcetype=indexA_sourcetype ) OR ( index=indexB sourcetype=indexB_sourcetype)
| fields indexA_agentB indexB_agentB sourcetype
| eval agentB = coalesce(indexA_agentB,indexB_agentB)
| stats dc(sourcetype) as dc_sourcetype values(sourcetype) as sourcetype values(indexA_agentB_raw) values(indexB_agentB_raw) by agentB
| where dc_sourcetype=2

But, both the method did not work as the search filter allows the only host, source, source type, event type, search fields.

Kindly let me know for any better option to restrict the user access only to agentB data from both the indexes.

[7thdrxn]

The search looks solid but I feel like something is up with your coalesce. From this example, the same event will not have both "indexA_agentB" and "indexB_agentB" so a coalesce will not do anything. I think what you're trying to do is rename the field they share so that they are the same, and then your stats by that field will accurately show which comes from two sourcetypes.